Terms for IT/OT operations and security

ISO/IEC 27001 is an international standard for information-security management systems.

The standard requires structured management of risks, responsibilities, controls, and evidence; asset inventories are a foundational input.

IT comprises systems, networks, and software that process, store, transmit, or provide information.

In companies, IT typically covers servers, clients, identities, applications, cloud services, networks, and data processes.

An IT security incident is an event in which the confidentiality, integrity, availability, or authenticity of IT or OT systems may be impacted.

For regulated companies, clear reporting paths, contact points, situational information, and reliable asset and dependency data matter so that the response does not stall at taking stock.

ITAM stands for IT asset management and describes the structured collection and maintenance of IT assets across their operational lifecycle.

For security and operations, ITAM connects asset identity, technical state, accountability, data sources, and dependencies. This website focuses on operational visibility and a dependable picture of the IT estate.

ITSM stands for IT service management and describes how IT services are governed through processes, roles, tools, and continuous improvement.

Typical ITSM work covers incidents, service requests, changes, problems, and service levels. A current asset and dependency baseline makes that work faster and more dependable.

KRITIS is the German abbreviation for critical infrastructure: facilities and services whose disruption would have a significant impact on society.

For operators, KRITIS is not only a compliance term. In operations, critical services, facilities, IT/OT dependencies, suppliers, risks, and evidence must stay connected so supply and response remain resilient.

LDAP is a protocol for accessing directory services; Active Directory Domain Services is Microsoft's directory service for network objects, users, computers, and resources.

For asset and access context, directory services matter because they shape accounts, groups, devices, permissions, and authentication paths across many enterprise networks.

Machinery Regulation (EU) 2023/1230 sets the essential health and safety requirements for machinery on the EU single market and applies from 20 January 2027.

It replaces the Machinery Directive and adds cyber safety to the essential requirements: relevant interventions in hardware, software, or configuration must become traceable.

MDM stands for mobile device management and describes central management of mobile devices and endpoints through enrollment, policies, and device configuration.

In operations, MDM helps onboard devices securely and govern apps, updates, compliance state, and access requirements. It becomes more useful when MDM data is connected with inventory, identities, EDR, and ITSM.

MSP stands for managed service provider: a company that continuously delivers IT, security, or operational services for customers.

In operations, an MSP works across multiple customers, contracts, and tool stacks. Tenant separation, clear responsibilities, current asset data, traceable service evidence, and secure access paths are therefore central.

NIS is the European legal framework for a higher level of cybersecurity in network and information systems.

The NIS2 directive expands the scope and tightens governance, risk, and reporting requirements for many organizations.

NIST is a US federal agency for standards, metrology, and technical guidance.

In a cybersecurity context, NIST guidance such as the Cybersecurity Framework or NIST SP 800-82 for OT security is broadly referenced.

OAuth is an authorization standard that lets an application obtain access to resources without disclosing user passwords to the application.

OAuth works with access tokens and is often combined with OpenID Connect; OAuth authorizes access, while OIDC adds the identity layer for authentication.

OIDC (OpenID Connect) is a standard that lets users sign in through an external identity provider instead of keeping a separate password for each application.

OIDC builds on OAuth 2.0. An application redirects the sign-in to the identity provider, which confirms the identity and returns a token. User management stays central, for example in Microsoft Entra ID.

OT covers hardware and software that monitor and control physical devices, plants, processes, or infrastructure.

In OT environments, availability, process safety, real-time behavior, and controlled changes often weigh more heavily than in classic IT.

OTAM stands for OT asset management and describes the structured collection and maintenance of assets that monitor or control physical processes.

In addition to identity and technical state, OTAM accounts for firmware, topology, production role, long lifecycles, maintenance windows, and the distinct requirements for availability and process safety.

OWASP is a non-profit organization that provides freely usable materials and projects to improve software and application security.

The OWASP Operational Technology Top 10 project extends security risk coverage to industrial and OT-adjacent environments.

RBAC controls permissions through roles: users are assigned roles, and roles bundle the permitted actions or access.

The model reduces administrative effort in larger environments because permissions can be granted in line with tasks, responsibilities, and organizational units.